Related Issues

• Follow-up to the same input-mutation class as fix: give each FileContent its own extra dict in FileToFileContent #11872 (merged, FileToFileContent) and fix: prevent Answer.from_dict methods from mutating their input dict #11908 (Answer.from_dict), this time at the core serialization utility every component flows through.

Proposed Changes:

default_from_dict() took a reference to data["init_parameters"] and then, while auto-deserializing nested objects, replaced the serialized sub-dicts with their live instances in place:

init_params = data.get("init_parameters", {})   # reference into the caller's dict
...
init_params[key] = Secret.from_dict(value)       # mutates data["init_parameters"] in place

So after Component.from_dict(data) (which routes through default_from_dict), the caller's data is silently corrupted — its serialized Secret / ComponentDevice / nested-component dicts are swapped for live objects. A second deserialization of the same data, or any later re-serialization / comparison, then misbehaves.

PipelineBase.from_dict already deep-copies data before deserializing precisely to avoid this; the public default_from_dict / component_from_dict utilities did not. The fix copies init_parameters before mutating it (shallow is enough — only its top-level keys are reassigned).

How did you test it?

• Added test_component_from_dict_does_not_mutate_input, which deserializes a dict containing a serialized Secret and asserts (a) the returned component is correct and (b) the input dict is unchanged (data == deepcopy(data) taken before the call). It fails on main (the input's api_key sub-dict becomes an EnvVarSecret) and passes with the fix.
• python -m pytest test/core/test_serialization.py → all green (23 tests).
• ruff check / ruff format --check clean on both files.

Notes for the reviewer

Minimal one-line change at the single choke point (component_from_dict delegates here), so it covers every path. This complements #11908's dataclass-level fix by closing the same leak in the core utility.

This PR was written with the help of an AI assistant. I have reviewed the changes and run the relevant tests locally.

Checklist

• I have read the contributors guidelines and the code of conduct.
• Conventional commit type in the PR title (fix:).
• I have added a unit test and documented the change.
• I have added a release note file.